繁體中文
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어

#netsupport 搜尋結果

YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
年10月21日

Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…

YungBinary's tweet image. Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…
1
21
112
31
15千
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
年10月24日

New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…

YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
3
18
75
22
12千
James_inthe_box's profile picture.
James
 @James_inthe_box
年1月22日

#webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA

James_inthe_box's tweet image. #webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA
2
7
27
8
4千
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
年7月21日

5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT

skocherhan's tweet image. 5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT
0
1
2
0
250
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2023年1月30日

Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm

1ZRR4H's tweet image. Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm
5
9
26
4
13千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2023年12月2日

🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…

1ZRR4H's tweet image. 🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…
0
18
62
9
19千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2024年4月5日

🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…

1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1
8
46
8
4千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2024年1月24日

Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…

1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
2
17
39
7
6千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2023年9月29日

This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…

1ZRR4H's tweet image. This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…
11
40
186
62
63千
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
2 小時

#NetSupport #Rat Client32.ini MD5 e6286f82fd32f5a9baf88eb256c17694 GatewayAddress=perropa.]com:443 SecondaryGateway=menuderg.]com:443 88.218.64.]49:443 Samples bazaar.abuse.ch/browse/tag/88-… cc @500mk500 @VirITeXplorer @c_APT_ure

JAMESWT_WT's tweet image. #NetSupport #Rat Client32.ini MD5 e6286f82fd32f5a9baf88eb256c17694 GatewayAddress=perropa.]com:443 SecondaryGateway=menuderg.]com:443 88.218.64.]49:443 Samples bazaar.abuse.ch/browse/tag/88-… cc @500mk500 @VirITeXplorer @c_APT_ure
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
23 小時

'payload_1.ps1' @abuse_ch bazaar.abuse.ch/sample/7e5caa7… C2: hxxp://88.218.64(.)49/fakeurl.htm hxxp://88.218.64(.)49:443/fakeurl.htm VT FUD but 9 @nextronresearch comments

smica83's tweet image. 'payload_1.ps1' @abuse_ch bazaar.abuse.ch/sample/7e5caa7… C2: hxxp://88.218.64(.)49/fakeurl.htm hxxp://88.218.64(.)49:443/fakeurl.htm VT FUD but 9 @nextronresearch comments
0
3
5
0
858
1
0
2
2
469
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年10月8日

#netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2

JAMESWT_WT's tweet image. #netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2
1
6
21
0
2千
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年8月26日

#netsupport submission from bazaar.abuse.ch/user/10197/ User "monitorsg"💯😎👍 Today I finished to add gateway ip tag to all samples from 2025 to 2023 👇 bazaar.abuse.ch/browse/tag/Sma…

JAMESWT_WT's tweet image. #netsupport submission from bazaar.abuse.ch/user/10197/ User "monitorsg"💯😎👍 Today I finished to add gateway ip tag to all samples from 2025 to 2023 👇 bazaar.abuse.ch/browse/tag/Sma…
JAMESWT_WT's tweet image. #netsupport submission from bazaar.abuse.ch/user/10197/ User "monitorsg"💯😎👍 Today I finished to add gateway ip tag to all samples from 2025 to 2023 👇 bazaar.abuse.ch/browse/tag/Sma…
0
3
10
0
886
solicydotnet's profile picture. Helping projects achieve growth and scalability in the decentralized world through cutting-edge #development and innovative #Web3 solutions.
Solicy
@solicydotnet
2023年1月9日

❌ WARNING 🚨 Hackers have used a well-crafted #PokemonNFT card game website to distribute the #NetSupport remote access tool 💀 They can now remotely connect to a user's device to steal data, install other malware, etc #pokemonCards #Hacked #GamingNews #NFTs

solicydotnet's tweet image. ❌ WARNING 🚨 Hackers have used a well-crafted #PokemonNFT card game website to distribute the #NetSupport remote access tool 💀 They can now remotely connect to a user's device to steal data, install other malware, etc #pokemonCards #Hacked #GamingNews #NFTs
0
6
20
0
277
nettrke's profile picture. This is the official account of The National Environment Tribunal
NATIONAL ENVIRONMENT TRIBUNAL
 @nettrke
2023年9月29日

📣 Need to get in touch with NET? 🤝 We are here to help. For any inquiries, questions, or assistance, you can contact us through the following channels. Our team is ready to assist you! Don't hesitate to reach out. 🔗 #ContactUs #NETSupport

nettrke's tweet image. 📣 Need to get in touch with NET? 🤝 We are here to help. For any inquiries, questions, or assistance, you can contact us through the following channels. Our team is ready to assist you! Don't hesitate to reach out. 🔗 #ContactUs #NETSupport
0
0
1
0
105
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
年8月6日

'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)

smica83's tweet image. 'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)
2
4
15
1
742
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年8月26日

#NetSupport #Rat Client32.ini MD5 de6d8f6af4bf9087a4d2ab3c88e2cb14 👇 ⛔️194.0.234.]17:443 Client32.ini MD5 006a74830a4047fe9e1d5e574a2e6eba 👇 ⛔️193.24.123.]37:443 Samples bazaar.abuse.ch/browse/tag/194… bazaar.abuse.ch/browse/tag/193… cc @500mk500 @skocherhan @abuse_ch

JAMESWT_WT's tweet image. #NetSupport #Rat Client32.ini MD5 de6d8f6af4bf9087a4d2ab3c88e2cb14 👇 ⛔️194.0.234.]17:443 Client32.ini MD5 006a74830a4047fe9e1d5e574a2e6eba 👇 ⛔️193.24.123.]37:443 Samples bazaar.abuse.ch/browse/tag/194… bazaar.abuse.ch/browse/tag/193… cc @500mk500 @skocherhan @abuse_ch
1
10
22
2
1千
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年8月31日

#netsupport #rat ❇️Client32.ini MD5 👉ef882a180b4d95e3694be055d60367f8 👉26924d58c0d5fadf5e5c96bdc7532ea5 Gateway👇 ⛔️westford-systems.]icu:1203 ⛔️cdn.westford-computing6.]net:1203 Sample👇 bazaar.abuse.ch/sample/d5348df… Reference👇 malware-traffic-analysis.net/2025/08/20/ind… cc @500mk500 @skocherhan

JAMESWT_WT's tweet image. #netsupport #rat ❇️Client32.ini MD5 👉ef882a180b4d95e3694be055d60367f8 👉26924d58c0d5fadf5e5c96bdc7532ea5 Gateway👇 ⛔️westford-systems.]icu:1203 ⛔️cdn.westford-computing6.]net:1203 Sample👇 bazaar.abuse.ch/sample/d5348df… Reference👇 malware-traffic-analysis.net/2025/08/20/ind… cc @500mk500 @skocherhan
1
6
29
2
2千
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
2 小時

#NetSupport #Rat Client32.ini MD5 e6286f82fd32f5a9baf88eb256c17694 GatewayAddress=perropa.]com:443 SecondaryGateway=menuderg.]com:443 88.218.64.]49:443 Samples bazaar.abuse.ch/browse/tag/88-… cc @500mk500 @VirITeXplorer @c_APT_ure

JAMESWT_WT's tweet image. #NetSupport #Rat Client32.ini MD5 e6286f82fd32f5a9baf88eb256c17694 GatewayAddress=perropa.]com:443 SecondaryGateway=menuderg.]com:443 88.218.64.]49:443 Samples bazaar.abuse.ch/browse/tag/88-… cc @500mk500 @VirITeXplorer @c_APT_ure
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
23 小時

'payload_1.ps1' @abuse_ch bazaar.abuse.ch/sample/7e5caa7… C2: hxxp://88.218.64(.)49/fakeurl.htm hxxp://88.218.64(.)49:443/fakeurl.htm VT FUD but 9 @nextronresearch comments

smica83's tweet image. 'payload_1.ps1' @abuse_ch bazaar.abuse.ch/sample/7e5caa7… C2: hxxp://88.218.64(.)49/fakeurl.htm hxxp://88.218.64(.)49:443/fakeurl.htm VT FUD but 9 @nextronresearch comments
0
3
5
0
858
1
0
2
2
469
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年10月28日

#netsupport #rat Samples Collection updated/tagged Client32.ini (MD5) f95f40e6a0f9c20369f95aa88d03f2b5 atmospheredast.]com:443 generationkasdm.]com:443 3bdea8a253b8f6aefb1a9cb4bf221a48 5.181.156.]97:1203 641b7b91479e9c44e03771740c5b3713 benafaciario.]com:444 chiklx.]com:444

1
2
6
1
777
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年10月28日

#netsupport #rat GatewayAddress=sonosnewfq[.]com:2081 SecondaryGateway=sonosnewbh[.]net:2081 Client32.ini a9cdf2b5b8d7de09a04176bff77dc4a8 (MD5) LIC 7a8a0027f479608173a1087818d3722c(MD5) Samples bazaar.abuse.ch/browse/tag/son… cc @500mk500

JAMESWT_WT's tweet image. #netsupport #rat GatewayAddress=sonosnewfq[.]com:2081 SecondaryGateway=sonosnewbh[.]net:2081 Client32.ini a9cdf2b5b8d7de09a04176bff77dc4a8 (MD5) LIC 7a8a0027f479608173a1087818d3722c(MD5) Samples bazaar.abuse.ch/browse/tag/son… cc @500mk500
SquiblydooBlog's profile picture. Malware Analysis Creator of Debloat, certReport, and https://t.co/w4rAuuB7O0 Want to chat? Join the Debloat discord: https://t.co/ZcWIqa6ZA9
Squiblydoo
 @SquiblydooBlog
年10月25日

NetSupport RAT Signed "Advik Tech Corporation" (SSL[.com) acfa8e673b641ed1be17dff41f52589605abbd3afe305a1580b3c8977e90a7fa Snake(?) same signer (GlobalSign) fc3471e819eafc1640b51c5c8d4bd36db60dc96d912769fa0dfd619f3ec6ff09 h/t @malwrhunterteam

SquiblydooBlog's tweet image. NetSupport RAT Signed "Advik Tech Corporation" (SSL[.com) acfa8e673b641ed1be17dff41f52589605abbd3afe305a1580b3c8977e90a7fa Snake(?) same signer (GlobalSign) fc3471e819eafc1640b51c5c8d4bd36db60dc96d912769fa0dfd619f3ec6ff09 h/t @malwrhunterteam
1
7
34
8
13千
1
1
10
0
1千
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
年10月24日

New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…

YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
3
18
75
22
12千
TweetThreatNews's profile picture. 🔍 ThreatResearch 📰 CybersecurityNews 🖥️ RansomMonitor 📂 Cyber Attack 📂 Data Breach 🎥 Youtube
Cybersecurity News Everyday
 @TweetThreatNews
年10月24日

eSentire TRU uncovered multiple 2025 campaigns abusing NetSupport Manager via ClickFix, using PowerShell/JSON, Run Prompt loaders, and MSI installers. Activity grouped into EVALUSION, FSHGDREE32/SGI, and XMLCTL actors. #RemoteAccess #NetSupport ift.tt/cmj49uw

TweetThreatNews's tweet card. eSentire's TRU investigated numerous 2025 incidents where threat actors abused legitimate NetSupport Manager RMM, primarily delivered via the ClickFix social engineering vector and executed through...
Unpacking NetSupport RAT Loaders Delivered via ClickFix
來源: hendryadrian.com
0
0
1
0
136
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
年10月23日

gatewayaddress[.]benafaciario[.]com secondarygoteway[.]chiklx[.]com balofult[.]com mugolens[.]com chiklx[.]com benafaciario[.]com 88[.]214[.]27[.]48:444 AS209272 Alviva Holding Limited 🇩🇪 #NetSupport

skocherhan's tweet image. gatewayaddress[.]benafaciario[.]com secondarygoteway[.]chiklx[.]com balofult[.]com mugolens[.]com chiklx[.]com benafaciario[.]com 88[.]214[.]27[.]48:444 AS209272 Alviva Holding Limited 🇩🇪 #NetSupport
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
年10月23日

'dynatrc.ps1' is a new record for @nextronresearch with 9 thor detection hit. bazaar.abuse.ch/sample/33c017a… URL: hxxp://144.31.0(.)44/dynatrc.php

smica83's tweet image. 'dynatrc.ps1' is a new record for @nextronresearch with 9 thor detection hit. bazaar.abuse.ch/sample/33c017a… URL: hxxp://144.31.0(.)44/dynatrc.php
1
3
6
1
848
0
0
1
0
733
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年10月22日

#netsupport #rat Client32.ini MD5 7a9adb61e63b59a6a94ba289082ccfdd GatewayAddress=5.181.156.]153:443 Samples👇 bazaar.abuse.ch/browse/tag/5-1… @500mk500

JAMESWT_WT's tweet image. #netsupport #rat Client32.ini MD5 7a9adb61e63b59a6a94ba289082ccfdd GatewayAddress=5.181.156.]153:443 Samples👇 bazaar.abuse.ch/browse/tag/5-1… @500mk500
1
3
26
3
2千
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
年10月22日

🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport

NetSupport_Corp's tweet image. 🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport
0
0
0
0
5
NetSupportICorp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportInc
NetSupport-Inc Corp
 @NetSupportICorp
年10月22日

🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport

NetSupportICorp's tweet image. 🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport
0
0
0
0
4
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
年10月21日

Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…

YungBinary's tweet image. Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…
1
21
112
31
15千
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
年10月17日

What a week! We had an absolutely amazing time connecting with everyone at GITEX GLOBAL 2025. Thank you to all the attendees and partners who stopped by our stand! 👋 Check out our upcoming events buff.ly/LIZ2lR6 #NetSupport #GITEX #EventWrapUp #ThankYou #UntilNextTime

0
0
0
0
15
NetSupportICorp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportInc
NetSupport-Inc Corp
 @NetSupportICorp
年10月17日

Can you see your wasted IT spending? NetSupport DNA can. 👀 Identify unused licenses, under-utilized hardware, and wasted energy to maximize ROI for your business. Learn more: buff.ly/94BBxR1 #ITAssetManagement #NetSupport #ITBudgets

NetSupportICorp's tweet image. Can you see your wasted IT spending? NetSupport DNA can. 👀 Identify unused licenses, under-utilized hardware, and wasted energy to maximize ROI for your business. Learn more: buff.ly/94BBxR1 #ITAssetManagement #NetSupport #ITBudgets
0
0
0
0
11
NetSupportNSM's profile picture. Leading the way in remote PC management for 33 years, NetSupport Manager is the award-winning multi-platform remote control solution from @NetSupport_Corp
NetSupport Manager
 @NetSupportNSM
年10月14日

We're live at GITEX GLOBAL 2025 and ready to show you the power of secure remote control. 🚀 Stop by our stand for a live demo of NetSupport Manager and see how you can get fast, secure remote control over any device. 📍 Find the team at Stand H4A-20. #NetSupport #GITEXGLOBAL

NetSupportNSM's tweet image. We're live at GITEX GLOBAL 2025 and ready to show you the power of secure remote control. 🚀 Stop by our stand for a live demo of NetSupport Manager and see how you can get fast, secure remote control over any device. 📍 Find the team at Stand H4A-20. #NetSupport #GITEXGLOBAL
0
0
0
0
25
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
年10月13日

Come and see the NetSupport team for an exclusive demo of our latest solutions and score some awesome freebies! Stop by our stand to say hello! 👋 Learn more about the event: gitex.com #NetSupport #GITEX #TechEvent #FutureTech #Freebies #GITEX2025 @GITEX_GLOBAL

NetSupport_Corp's tweet image. Come and see the NetSupport team for an exclusive demo of our latest solutions and score some awesome freebies! Stop by our stand to say hello! 👋 Learn more about the event: gitex.com #NetSupport #GITEX #TechEvent #FutureTech #Freebies #GITEX2025 @GITEX_GLOBAL
0
0
0
0
36
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年10月8日

#netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2

JAMESWT_WT's tweet image. #netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2
1
6
21
0
2千
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
年7月21日

5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT

skocherhan's tweet image. 5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT
0
1
2
0
250
Kostastsale's profile picture. No longer active here – find me on Bluesky: https://t.co/qHzDSxCjq8. 🇬🇷🇨🇦
Kostas
 @Kostastsale
2023年8月10日

Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…

Kostastsale's tweet image. Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…
Kostastsale's tweet image. Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…
Kostastsale's tweet image. Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…
2
43
104
29
21千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2023年9月29日

This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…

1ZRR4H's tweet image. This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…
11
40
186
62
63千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2023年12月2日

🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…

1ZRR4H's tweet image. 🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…
0
18
62
9
19千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2023年1月30日

Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm

1ZRR4H's tweet image. Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm
5
9
26
4
13千
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
年10月24日

New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…

YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
3
18
75
22
12千
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
年10月21日

Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…

YungBinary's tweet image. Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…
1
21
112
31
15千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2024年4月5日

🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…

1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1
8
46
8
4千
g0njxa's profile picture. ChatGPT says I'm a cyber researcher :) | donate 💸 to g0njxa.eth 💖 | Bad student, enthusiast, defo not an expert DMs are open, feel free to reach! 😼☂️🟣
Who said what?
@g0njxa
年11月27日

A brief example analysis of the malware spread over SEO Poisoning, delivering #Lumma Stealer and #NetSupport targeting hard crypto wallets Thread👇👇

g0njxa's tweet image. A brief example analysis of the malware spread over SEO Poisoning, delivering #Lumma Stealer and #NetSupport targeting hard crypto wallets Thread👇👇
2
22
58
15
8千
James_inthe_box's profile picture.
James
 @James_inthe_box
年1月22日

#webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA

James_inthe_box's tweet image. #webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA
2
7
27
8
4千
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
2024年1月24日

Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…

1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
2
17
39
7
6千
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
年8月11日

144[.]172[.]104[.]121 AS14956 ROUTERHOSTING 🇺🇸 #NetSupport

skocherhan's tweet image. 144[.]172[.]104[.]121 AS14956 ROUTERHOSTING 🇺🇸 #NetSupport
0
0
0
0
192
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
年8月6日

'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)

smica83's tweet image. 'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)
2
4
15
1
742
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
年8月26日

#NetSupport #Rat Client32.ini MD5 de6d8f6af4bf9087a4d2ab3c88e2cb14 👇 ⛔️194.0.234.]17:443 Client32.ini MD5 006a74830a4047fe9e1d5e574a2e6eba 👇 ⛔️193.24.123.]37:443 Samples bazaar.abuse.ch/browse/tag/194… bazaar.abuse.ch/browse/tag/193… cc @500mk500 @skocherhan @abuse_ch

JAMESWT_WT's tweet image. #NetSupport #Rat Client32.ini MD5 de6d8f6af4bf9087a4d2ab3c88e2cb14 👇 ⛔️194.0.234.]17:443 Client32.ini MD5 006a74830a4047fe9e1d5e574a2e6eba 👇 ⛔️193.24.123.]37:443 Samples bazaar.abuse.ch/browse/tag/194… bazaar.abuse.ch/browse/tag/193… cc @500mk500 @skocherhan @abuse_ch
1
10
22
2
1千
g0njxa's profile picture. ChatGPT says I'm a cyber researcher :) | donate 💸 to g0njxa.eth 💖 | Bad student, enthusiast, defo not an expert DMs are open, feel free to reach! 😼☂️🟣
Who said what?
@g0njxa
2024年10月22日

#ClickFix campaign targeting web3 users on YouTube sponsored videos spreading #Netsupport RAT Malicious paste: /pastesnip.com/raw/sNu60aPq Video: //www.youtube.com/watch?v=Qabajxy0OKY Detonation: app.any.run/tasks/f993b425…

g0njxa's tweet image. #ClickFix campaign targeting web3 users on YouTube sponsored videos spreading #Netsupport RAT Malicious paste: /pastesnip.com/raw/sNu60aPq Video: //www.youtube.com/watch?v=Qabajxy0OKY Detonation: app.any.run/tasks/f993b425…
g0njxa's tweet image. #ClickFix campaign targeting web3 users on YouTube sponsored videos spreading #Netsupport RAT Malicious paste: /pastesnip.com/raw/sNu60aPq Video: //www.youtube.com/watch?v=Qabajxy0OKY Detonation: app.any.run/tasks/f993b425…
2
10
30
9
3千
crep1x's profile picture. Lead cybercrime analyst, tracking adversaries activities & infrastructure, at @sekoia_io
crep1x
 @crep1x
年11月4日

An advertisement campaign on X is spreading a malware distribution website (fake Pokemon Cards NFT) that has reached more than 200k view pokemoncrypto.]cards > PokemonCards.]exe tria.ge/241104-wgv18at… #NetSupport RAT C2: 147.45.198.]18:9999 aholicist.duckdns.]org ⬇️

crep1x's tweet image. An advertisement campaign on X is spreading a malware distribution website (fake Pokemon Cards NFT) that has reached more than 200k view pokemoncrypto.]cards > PokemonCards.]exe tria.ge/241104-wgv18at… #NetSupport RAT C2: 147.45.198.]18:9999 aholicist.duckdns.]org ⬇️
crep1x's tweet image. An advertisement campaign on X is spreading a malware distribution website (fake Pokemon Cards NFT) that has reached more than 200k view pokemoncrypto.]cards > PokemonCards.]exe tria.ge/241104-wgv18at… #NetSupport RAT C2: 147.45.198.]18:9999 aholicist.duckdns.]org ⬇️
3
9
21
10
4千
tliffick's profile picture. Security Analyst | Blue Team | Windows Engineer | Father | Lover of coffee and whiskey | Wishing we wouldn’t be a$$holes to one another | Opinions are my own
Trent
 @tliffick
2023年5月15日

#NetSupport -- .zip > .js > .ps1 MD5: .zip == 6e7e921e662b0ec81c8f8d9455b4e328 .js == d82377d68d4173606ac169b237cbbc3b C2: hxxps://pipecoasia[.]com/f1.ps1 hxxp://193.233.233[.]92/index.php #NetSupportManager #malware

tliffick's tweet image. #NetSupport -- .zip > .js > .ps1 MD5: .zip == 6e7e921e662b0ec81c8f8d9455b4e328 .js == d82377d68d4173606ac169b237cbbc3b C2: hxxps://pipecoasia[.]com/f1.ps1 hxxp://193.233.233[.]92/index.php #NetSupportManager #malware
0
0
0
0
130

Something went wrong.


Something went wrong.


United States Trends